b761357b614f5ac8d927323b0d5e0be78e77aca00496c8d6975e2963f694ab8e

Analysis

max time kernel
136s
max time network
134s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 11:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fe6f8c21f3f094e1090c7ee55fd0065d_JaffaCakes118.html
Size

68KB
MD5

fe6f8c21f3f094e1090c7ee55fd0065d
SHA1

ec0e0beaf79ed9157d097175cf74ab7d644aae0a
SHA256

b761357b614f5ac8d927323b0d5e0be78e77aca00496c8d6975e2963f694ab8e
SHA512

8a8335ccfdba80ae3e6215287a7856f4a58707d7b6ac3b8bb256f65c5e1c473fea4073d39fb5750608ca19f5b02ebabd1dca81eeeddf6e6e4259040225260d72
SSDEEP

768:Ji7GgcMiR3sI2PDDnX0g6WB5KboTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVG8X:JmTKUTcNen0tbrga94hcuNnQC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00f5811d6312db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000cbad6fd20fc58ccdb0854d719f3c21c266182d18d98eb8a2dec376e7cbdca5be000000000e80000000020000200000004b630f7751af3b639323710daa966b1248d288b3dfa6d81c53083f484a47909520000000d657d4a481d4aa48fca19e681e1073d5c47e47212a32330ee08a4ca03849f03a400000002fd01330a5a654e2b27f86bcc04caff33617209386ed4c46ae8d68fd4df6e6bd51578983193d1a749682cb684f4eb6985eece425e65c6d1a8e8c6208e02cd6c8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{480DDCD1-7E56-11EF-9B59-D60C98DC526F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433771321"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000005cc0e6d8e13a62db8f74a0dc9be2248d4489a6cc8aa42161f65ddb911be58bfb000000000e8000000002000020000000a7bbf86afc22a238751d9bfbe81558940e8f788af0d21f8bbb50e6a397edbbb790000000608661f65b4365260e161b51ee60dc5c3796309b4a62864b590a72359f32452daa6eae14bd39068daa8485dc96c70ee95389becba63ece515141f2df12c46f24285429656392e31b4dd09508075eb4ee3ade2611c00006a418f1dcea8d5ba64bb88a860a0805b1b4c249ebe0cb0fd8c8a06f2c3d0e3e8603058aafee12affce863f83dac79a96aa55448ebaaf046db8b4000000065d1dd97d5e019ec31894d9a9c0c22e76c9f0a8a7c32832fcbb9ce8ae0d4f4132beb1cb2806523559c2eb1ff7170b0d7384f1bfec8316eed11612e0fcb02e015	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1140	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1140	iexplore.exe
1140	iexplore.exe
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2276	1140	iexplore.exe	29
PID 1140 wrote to memory of 2276	1140	iexplore.exe	29
PID 1140 wrote to memory of 2276	1140	iexplore.exe	29
PID 1140 wrote to memory of 2276	1140	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fe6f8c21f3f094e1090c7ee55fd0065d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1140 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de754b1ec384079baa886bf57a985281

SHA1
709c5f17dad3c981e4335e5529835f324e6de129

SHA256
11f1a7523e3f8b03e9664111472b75177ea671ab96810ee8cda0b220aff58948

SHA512
663f11559a80260fe8738b0034eed4cf4f063ac2a317fab2034c26822837513dedbd060e198fde72ba370bfb01c5a756372d5de1c87d4fe20815f7311619ad78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eca404211a6ad0dac5d2214a17b99ce7

SHA1
71122410483a0ebafe8c80aa37bf433f096c2717

SHA256
982dd2f9990186534772d1ef9caa953bd928abbfc4d8ab2762a33430a463c7f1

SHA512
cf09f7d59d09a82301e4563ffb9e9907ee5726f661335a01f9f13fa17fdfba38844503cf52fc6a3728668a8001d1b294ed06bbce793f3803234dbaba81cc765b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2e8715a43eb2c338857c2f88d9ac332

SHA1
4a29fb2ef20c615deff76a069ed0ec9e095e12e9

SHA256
17846fcb696f2477c8be9b806221e1d77a6f553c592c7a9cbea2ac3eb9df19ed

SHA512
67beafbcc8654baa4a995cb141e13440810a5909a051df2ae318bfc6aedf898adf17659b458ed2df50a30856ee1738b4363beaa289068220b59497a833a5d43d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cd06bf4772182ece062b5536aa92a29

SHA1
331f7b25a10392fc0289f475733d4e852a83894c

SHA256
a9f5779f9cd1f9ea181ed7827890168383097fc7c526ae30e960d5fe8c195e12

SHA512
5e1b293056af6ab0cf5196d3593da7c8a36850bdac1639ba7ad437c08f34d583d45ef348fe40cf84117f01d29620dd3c7754bc535dd67207d2fd614e80eac981

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b347a66021fd06bf6f5ba5228b895ff5

SHA1
519289822728fd38087d2811148077ff45345505

SHA256
415e5972f94ec3ea5d00ad7245936be4618000485f9ff652b64a98c39ab704cd

SHA512
f24eff4e4e3a3e435f3bbb17f2747481de03606d861216486ac269898636d900313e2a046c6bdeddc7c7b3c5f1e1134b0c9dd62b9ee8bc2eb0588cfd0edbe94c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bcdd84b10af3208cd17f173d7e8b8ca

SHA1
0e24e2854842bea462d625382ec202a4352a0c3c

SHA256
c3ad420335c8f613bd2abbd3404fe03dcfd1f23c27a78fe1adaac452bf7c6741

SHA512
4ba6a8a266d762d98436b90167a6ee42f145aa5078315fbb179bea8bd8379ab694f644499d074575afc9b259a5252e8daf7cd840bac1df5eb38178e17685f812

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e8822928feeb44caf384bc366e549ba

SHA1
d7771f037fac5f9cad116c226776059902640dcf

SHA256
74e9c484bcebe13f6cd25f26e83b4941c97ab1fd236035f1835f4647cb007a9c

SHA512
422da4d0baa20f9bbe7e9b8343199a9b073a3ef5951dc1729b5f302be278f31adfaac6dfc7150dde441cf78edca60a874091331832c7a9899f0d9efb6c3671f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9692b40a2c330c950445874441a5e8c

SHA1
f23f68263a583ed8dcf3cd08ca42f39471e52625

SHA256
94733107d1793466823f22798d1c22b6c211d791e8a7a7be00be4b6cd0d3aaf6

SHA512
e08f106fec6786bbf3b1eba7cc04d159b4e43c8bcdd6d7a4d67d1fb651355196a95d1a33f4b1f27971e3af241ed3283b210e70154a8a1839a344c4cf7d6c0e62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb94b6d46d2f82557732a07f723be3ad

SHA1
28a3c0bbd84121cf02dc233146081e10b00ca4f3

SHA256
57403b48a11a3f57be2784dfd25b8e787009846955a3e4a1cd514c7ba6c0be7b

SHA512
6a53a8a70de4d45f5a47945f911624d40901b35fb86f8372709fd9e144c1712cc1a8faccfba5df21aea8ec1a675fee860afd00054d0e4c453a4899296098c947

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac4542c5f1955e0fc857bbfab5e4d8bd

SHA1
9d92659ab9a27d263b5494ff29ae2f577a2bb7de

SHA256
05448dfabb864f5bc049e45f33f98b88675f259eb933c73b9ca1844309d336f5

SHA512
a5ac73518739aefb8f79ca0adff9dd733334c3ae64baf9d8ecd5a3a78bd7922a6ca963bbdf65f650462c10de60abdbd669a20c63e7d2621db146b0de6bf4e7ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76d1d14aa95464bb04da7cf9d066d9a9

SHA1
b80b02fc4521b702bf132952381e41f7f8f316c6

SHA256
6f1cb651b7af04377aa810026a243c0eebfbd56f5237d5cc1c3254fde14951d3

SHA512
3e2f1475b4329c106da7f44227f2d68ec83d6db79d9a3ab5e07407f3d23a6fe612521aa85298fc406f8856a67a912b50d02f88cdc0d5acf6f603caaaa7005e4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9628a7fe613f630e02e2002f539738ee

SHA1
54bc9fcf57f625d3ab5e409a93e53fcf3ef1dc45

SHA256
5a10777895719814376b12dccaf4456519107d2a1b450672302007b8c245e046

SHA512
5ef51a6b2fedc9ab39b8804d029e31e68851ba1a46007920f80143f636dc88505b06beec82281b24c64aceda9510f12f44bb003b0b63776ab2112fcc09ae7eb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13e9ad2b3c403c9a0617c6f8ebec73b9

SHA1
3ddda1ec08da7477382cede7aca3e0dcd9f7e609

SHA256
afba1bc2e613ecfe9aa02dd439aa34af8f456d9f1fd204d7284ee9c2c4ef64cf

SHA512
d0cc34f3eae7a59834f28d9adf6b505d547dcf8fd2b3ae8e78519067479012b78c59f6beb45b62b5c2198074f194e7ccf2a95d37892f88d5f62d408dec40f7b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebc56f0250296be5773154344c459197

SHA1
eac237615151eb40d04283317193d8b0c0c43d0b

SHA256
2c6ae34572f4b517ed6a69f95c5765b5bb294b761630fa27780d37d8b3b22f4a

SHA512
3861567db9b3343bbeb128d74faaa1f01a83388f840950f42d7dc96811bd5d39f1dd863990f82f926d2f1fc0095012644f308a8734f6a39bcb54ab17b82c2eeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
012684ca2e76a2e58d8bb7d47ab60037

SHA1
465f822d21019570695b65f16aab1ef635ed6834

SHA256
82c515c907f9292157905a1d8f10d716cf4df9afb5cf9f8eb290d70011434145

SHA512
9399ff768fe0d2dd425c17f47dd1106d53ce645697be0667589ca3e8df239500ad7ddbc00f2596873cd0b9c1edc12e3fc397623d3db25ed2138604a1c1e41747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b22e46236a24b82ab5f1f67184de99d3

SHA1
158f1d1a4476c53286697ac215e9c3f43c283267

SHA256
fa86dfc1fb057ad4d632214ef67945ada8382277300d2ba34a7d785e6e5d8a76

SHA512
08f417ef0f7ced8c98e4353661916a42632b65e241f1b2484dbedc97b14d01a8dee5d416e386d4483cdddd326d1729cf5d2482bae5f029b242ca754c814a8551

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abe18a21fe999f87ea2dfe80ec12cf1f

SHA1
d0f121a4b3658d7fb9c62da76ff99d0404aad63e

SHA256
ef6369462503971fed063458bbf9529bcafcca7e038023b7eef8ee478beb8971

SHA512
57ef2fc7900b7064a2e94c7a43dd9035ded53904df0c1d5eba847d4b9610b2f55f47ae132f961dd81993e5ab1ca7f760a17e8142bbdb31741aed4ddba23baa55

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBD0B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBDBC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit